Option to hide MCP servers with no tools available to the current user

[PeterMilanovics]

What features would you like to see added?

An opt-in setting to hide an MCP server from the tools dropdown (and the agent builder's MCP section) when the current user's tool list for that server is empty — either globally (interface.mcpServers.hideEmpty: true) or per server (hideWhenEmpty: true) in librechat.yaml.

More details

Our deployment (and, we believe, a growing number of enterprise deployments) puts LibreChat behind an MCP gateway that enforces per-user authorization: the gateway forwards the user's identity (via Authorization: Bearer {{LIBRECHAT_OPENID_ACCESS_TOKEN}} headers) to an external policy engine (OPA), which filters tools/list per user. Different users therefore see different tool sets for the same configured server — and for some users a given server legitimately resolves to zero tools.

Today every mcpServers entry from librechat.yaml is always shown to every user: the dropdown is populated from GET /api/mcp/servers, which resolves the configured servers without considering the user's tool catalog, and YAML-based servers get an implicit VIEW permission on the client (useMCPServerManager.ts). A user without access to a server's tools still sees the entry, can toggle it on, and gets an empty (0-tool) server — confusing UX, especially when servers are split into several themed entries.

The information needed to do better already exists: GET /api/mcp/tools (loadMCPServerCatalogs) already loads the per-user tool catalog per server, using the user's own headers. The ask is only to let the client use that data to filter the server list, behind an opt-in flag so current behavior is unchanged by default.

Suggested semantics:

• hide a server only when its per-user catalog has loaded AND contains zero tools;
• to avoid a show-then-yank flash, a flagged server stays out of the pickers until its catalog arrives and proves it non-empty; if the catalog query errors, nothing is hidden (fail-open for visibility);
• servers without the flag are never affected, so OAuth/authentication flows on unflagged servers remain reachable (operators should not flag OAuth-gated servers);
• apply the same filtering in the agent builder's MCP tool picker.

This complements the recently added MCP server ACLs (#9731): ACLs cover DB-stored servers managed inside LibreChat, while this option covers deployments where per-user tool authorization lives outside LibreChat (MCP gateway / ext_authz), with servers defined in librechat.yaml.

Implementation sketch (what our working branch does): a hideWhenEmpty field on the mcpServers schema in packages/data-provider (server-managed, exposed through the redaction allowlist); GET /api/mcp/tools marks each server with catalogLoaded so clients can distinguish "loaded and empty" from "catalog unknown" (connection or OAuth pending); useMCPServerManager filters selectableServers and the agent builder skips the same servers; unit tests for the filtering predicate. Default behavior is unchanged, and the tools catalog is not fetched by the hook unless a server opts in.

Implementation status: implemented and unit-tested in our fork, validated end-to-end in a production-like deployment (LibreChat behind an MCP gateway with OPA ext_authz filtering tools per user): https://github.com/PeterMilanovics/LibreChat/tree/feat/mcp-hide-when-empty (8 files, +164/−9). Happy to open the PR against dev if the approach is acceptable, and to adjust anything based on your feedback — including the option name or moving the flag under interface.mcpServers.

Which components are impacted by your request?

UI

[gyanu2507]

GET /api/mcp/servers is the configured list. GET /api/mcp/tools is already the per-user catalog (identity headers, OPA-filtered tools/list). Filtering the dropdown from the first endpoint is why empty servers stay visible. Using the second, behind an opt-in flag, is the right split.

The semantics in the sketch are the ones I would ship:

• hide only when catalogLoaded && tools.length === 0
• fail open on catalog errors (a timeout should not empty the picker)
• do not set hideWhenEmpty on OAuth-gated servers, or those auth flows become unreachable
• apply the same filter in the agent builder

Default off is required. YAML servers currently get implicit VIEW in useMCPServerManager.ts, so a global hide would surprise anyone whose empty list is "not connected yet" rather than "policy denied."

This sits next to MCP ACLs (#9731), it does not replace them. ACLs cover servers stored in LibreChat. Gateway / ext_authz deployments never create those rows.

The fork looks small enough. Open the PR against dev. Per-server hideWhenEmpty plus an optional interface.mcpServers.hideEmpty is a reasonable namespacing. I would keep the fail-open rule in the tests, it is the part that will regress.